fix: prevent internal error details leaking in HTTP responses

Replace err.Error() concatenation in JSON decode error responses with fixed 'invalid request body' message across 5 locations in custom_services.go, discount_campaigns.go, and services.go.

backend/handlers/services/services.go

@@ -101,10 +101,9 @@ func ToggleService(w http.ResponseWriter, r *http.Request) {
 
 // POST /api/admin/services
 func CreateServiceHandler(w http.ResponseWriter, r *http.Request) {
-	// Parse and validate request
 	var req CreateServiceRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
+		http.Error(w, "invalid request body", http.StatusBadRequest)
 		return
 	}
 	if err := validators.Validate.Struct(&req); err != nil {